joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1142c6d
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x11d05b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, ecx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], esi
cmp ebx, esi
jne 0x1142ca6
mov eax, 0x8876086c
jmp 0x1142dc4
cmp dword [ebp + 0xc], esi
je 0x1142d47
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
je 0x1142d29
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push 0xfde9
call ebx
push eax
mov dword [ebp - 0xa4], eax
call fcn.010a9635
pop ecx
mov dword [ebp - 0x9c], eax
cmp eax, esi
jne 0x1142d05
mov eax, 0x8007000e
jmp 0x1142dc4
push esi
push esi
push dword [ebp - 0xa4]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xa0]
push esi
push 0xfde9
call ebx
mov eax, dword [ebp - 0x9c]
mov dword [ebp + 0xc], esi
mov ebx, eax
cmp dword [ebp + 0xc], esi
je 0x1142d47
push esi
push 0x10000000
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x1142d5e
push esi
push 0x10000000
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push dword [ebp - 0x9c]
mov dword [edi], eax
call fcn.010a960b
mov eax, dword [edi]
pop ecx
cmp eax, 0xffffffff
je 0x1142db2
push esi
push esi
push esi
push 2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
je 0x1142db2
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [edi + 0xc], eax
cmp eax, 0xffffffff
je 0x1142db2
cmp eax, esi
je 0x1142dbf
push esi
push esi
push esi
push 4
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi + 8], eax
cmp eax, esi
jne 0x1142dc2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x88760b59
jmp 0x1142dc4
mov dword [edi + 8], esi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010aa5e1
leave
ret 8
Function at 0x1143055
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
xor esi, esi
push edi
cmp dword [ebx], esi
je 0x114306a
call fcn.0114302f
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp dword [ebp + 0x14], esi
jne 0x114307b
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp dword [ebp + 0x10], esi
je 0x1143090
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov esi, eax
test esi, esi
jne 0x11430a0
push 0xa
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov esi, eax
test esi, esi
je 0x11430cf
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebx + 8], eax
test eax, eax
je 0x11430cf
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebx], eax
test eax, eax
je 0x11430cf
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebx + 4], eax
test eax, eax
jne 0x11430dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x88760b59
jmp 0x11430de
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x11430ea
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x2000000
push 0
push 0x105a104
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x114314a
push edi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x114314a
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x114314a
xor eax, eax
inc eax
jmp 0x114314c
xor eax, eax
leave
ret 0x10

Function at 0x1143243
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
xor eax, eax
cmp dword [0x1239c10], eax
jne 0x11432dd
push ebx
push esi
push edi
mov esi, 0x105b1b8
xor edi, edi
push esi
inc edi
push eax
mov dword [0x1239c10], edi
mov dword [ebp - 4], eax
call fcn.01129d82
push esi
push 0
mov ebx, eax
call fcn.01129d82
add esp, 0x10
mov esi, eax
test ebx, ebx
je 0x114328d
test esi, esi
je 0x114328d
cmp ebx, esi
jne 0x1143290
mov dword [ebp - 4], edi
test ebx, ebx
je 0x114329b
push ebx
call fcn.010a960b
pop ecx
test esi, esi
je 0x11432aa
cmp esi, ebx
je 0x11432aa
push esi
call fcn.010a960b
pop ecx
push 0
call fcn.010a960b
cmp dword [ebp - 4], 0
pop ecx
je 0x11432da
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x10667b0
call esi
push 0x1066750
call esi
push 0x10666f8
call esi
push 0x10666c8
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1143327
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
mov dword [ebp - 0x14], eax
cmp edx, eax
jae 0x114344a
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, dword [ebp + 0x14]
jae 0x114342e
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x1143380
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
mov dword [ebp + 0xc], edx
cmp edx, dword [ebp - 0x14]
jb 0x114335e
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18
Function at 0x114fa2f
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
lea eax, [ebp - 0x24]
mov esi, ecx
and dword [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp + 0xc]
and dword [esi + 8], 0
and dword [esi + 0xc], 0
and dword [esi + 0x10], 0
lea eax, [ecx + eax - 1]
dec ecx
not ecx
and eax, ecx
mov ecx, dword [ebp + 8]
mov dword [esi + 4], eax
test ecx, ecx
jne 0x114fa71
mov ecx, 0x100000
lea ecx, [eax + ecx - 1]
dec eax
not eax
and ecx, eax
mov dword [esi + 0x14], ecx
mov eax, esi
pop esi
leave
ret 8
Function at 0x116941c
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
xor eax, eax
mov edi, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, dword [ecx + 4]
test esi, esi
je 0x116943d
mov eax, dword [ecx]
mov eax, dword [eax + 8]
add eax, esi
jmp 0x116943f
xor eax, eax
mov dword [edx], eax
movzx eax, word [ecx + 8]
mov dword [edx + 4], eax
movzx eax, word [ecx + 0xa]
mov dword [edx + 8], eax
movzx eax, word [ecx + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax]
mov dword [edx + 0x10], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 2]
mov dword [edx + 0x14], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 4]
mov dword [edx + 0x18], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 6]
mov dword [edx + 0x1c], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 8]
mov dword [edx + 0x20], eax
mov eax, dword [ecx + 0x18]
movzx eax, word [eax + 0xa]
mov dword [edx + 0x24], eax
mov eax, dword [edx + 0x20]
imul eax, dword [edx + 0x18]
imul eax, dword [edx + 0x1c]
shl eax, 2
mov dword [edx + 0x28], eax
mov esi, dword [ecx + 0x14]
test esi, esi
je 0x11694b2
mov eax, dword [ecx]
mov eax, dword [eax + 8]
add eax, esi
jmp 0x11694b4
xor eax, eax
pop edi
mov dword [edx + 0x2c], eax
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x11b17c0
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x11d05b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
cmp edi, 0x21
ja 0x11b18a4
je 0x11b1807
mov eax, edi
dec eax
je 0x11b18dd
sub eax, 5
je 0x11b1807
sub eax, 9
je 0x11b1845
dec eax
je 0x11b182f
sub eax, 0xc
jne 0x11b18be
cmp edi, 0x1c
je 0x11b18e7
cmp edi, 0x86
je 0x11b18e7
cmp edi, 6
jne 0x11b18e1
cmp word [ebp + 0x10], 0
jmp 0x11b18eb
xor edi, edi
push edi
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, ebx
call fcn.011b157c
jmp 0x11b193a
push 1
xor edi, edi
push edi
push esi
call dword [sym.imp.USER32.dll_GetUpdateRect]
test eax, eax
je 0x11b193a
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.USER32.dll_BeginPaint]
cmp eax, edi
jne 0x11b188b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x11b187c
and eax, 0xffff
or eax, 0x80070000
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], 0x1077f70
jmp 0x11b193a
push eax
push esi
mov ecx, ebx
call fcn.011b14dd
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x11b193a
mov eax, edi
sub eax, 0x7e
je 0x11b1924
sub eax, 4
je 0x11b18fb
sub eax, 4
je 0x11b1807
sub eax, 0x7c
je 0x11b18c7
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
jmp 0x11b1931
cmp dword [ebp + 0x10], 0x1b
jne 0x11b18dd
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, ebx
call fcn.011b157c
xor edi, edi
jmp 0x11b193a
mov byte [ebp - 0x48], 1
jmp 0x11b18f1
cmp dword [ebp + 0x10], 0
setne al
mov byte [ebp - 0x48], al
push dword [ebp - 0x48]
call fcn.011b1441
jmp 0x11b18be
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x82
push esi
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 0
push 0xffffffffffffffeb
push esi
mov edi, eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x11b193a
call fcn.011b13aa
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x7e
push esi
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010aa5e1
leave
ret 0x10
Function at 0x11b1c8d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x101830c
mov dword [esi], 0x1018308
mov dword [esi + 4], 0x80004005
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
call edi
mov dword [esi + 8], eax
cmp eax, ebx
jne 0x11b1d03
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x11b1cfb
and eax, 0xffff
or eax, 0x80070000
mov dword [esi + 4], eax
jmp 0x11b1e3d
push 0x10182f8
call edi
mov dword [esi + 0xc], eax
cmp eax, ebx
je 0x11b1ce7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10182ec
push dword [esi + 8]
call edi
mov dword [esi + 0x10], eax
cmp eax, ebx
je 0x11b1ce7
push 0x10182e0
push dword [esi + 8]
call edi
mov dword [esi + 0x14], eax
cmp eax, ebx
je 0x11b1ce7
push 0x10182d0
push dword [esi + 0xc]
call edi
mov dword [esi + 0x18], eax
cmp eax, ebx
je 0x11b1ce7
push 0x10780a8
push dword [esi + 8]
call edi
mov dword [esi + 0x1c], eax
cmp eax, ebx
je 0x11b1ce7
push 0x10182b0
push dword [esi + 0xc]
call edi
mov dword [esi + 0x20], eax
cmp eax, ebx
je 0x11b1ce7
push 0x1018298
push dword [esi + 0xc]
call edi
mov dword [esi + 0x24], eax
cmp eax, ebx
je 0x11b1ce7
push 0x1018280
push dword [esi + 0xc]
call edi
mov dword [esi + 0x28], eax
cmp eax, ebx
je 0x11b1ce7
push 0x1018268
push dword [esi + 0xc]
call edi
mov dword [esi + 0x2c], eax
cmp eax, ebx
je 0x11b1ce7
push 0x1018254
push dword [esi + 0xc]
call edi
mov dword [esi + 0x30], eax
cmp eax, ebx
je 0x11b1ce7
push 0x101823c
push dword [esi + 0xc]
call edi
mov dword [esi + 0x34], eax
cmp eax, ebx
je 0x11b1ce7
push 0x101821c
push dword [esi + 0xc]
call edi
mov dword [esi + 0x38], eax
cmp eax, ebx
je 0x11b1ce7
push 0x10181fc
push dword [esi + 0xc]
call edi
mov dword [esi + 0x3c], eax
cmp eax, ebx
je 0x11b1ce7
push 0x10780a0
push dword [esi + 8]
call edi
mov dword [esi + 0x40], eax
cmp eax, ebx
je 0x11b1ce7
push 0x1078094
push dword [esi + 8]
call edi
mov dword [esi + 0x44], eax
cmp eax, ebx
je 0x11b1ce7
push 0x1078080
push dword [esi + 8]
call edi
mov dword [esi + 0x48], eax
mov dword [esi + 4], ebx
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x11cd7f0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esi - 0x10]
mov eax, dword [esi - 0x14]
push edi
sub ecx, 2
xor edi, edi
cmp eax, ecx
jae 0x11cd843
push ebx
movzx edx, byte [eax + 2]
movzx ebx, byte [eax]
movzx ebx, word [ebx*2 + 0x1237948]
movzx edx, word [edx*2 + 0x1237d48]
xor edx, ebx
movzx ebx, byte [eax + 1]
movzx ebx, word [ebx*2 + 0x1237b48]
xor edx, ebx
mov bx, word [esi + edx*2 - 0x10054]
mov word [esi + edi*2], bx
mov word [esi + edx*2 - 0x10054], di
inc eax
inc edi
cmp eax, ecx
jb 0x11cd801
pop ebx
add ecx, 2
cmp eax, ecx
jae 0x11cd864
sub ecx, eax
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
lea edi, [esi + edi*2]
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
pop edi
ret
Function at 0x100d4a24
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101cf538]
jne 0x100d4a2e
repz ret
jmp fcn.100d69a9

Function at 0x100d9d3f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100d5a26
and dword [ebp - 4], 0
cmp dword [0x101d19c8], 0
mov ebx, eax
jne 0x100d9df0
push 0x101b71c0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100d9ea1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x101b71b4
push edi
call esi
test eax, eax
je 0x100d9ea1
push eax
call fcn.100d59b4
mov dword [esp], 0x101b71a4
push edi
mov dword [0x101d19c8], eax
call esi
push eax
call fcn.100d59b4
mov dword [esp], 0x101b7190
push edi
mov dword [0x101d19cc], eax
call esi
push eax
call fcn.100d59b4
mov dword [esp], 0x101b7174
push edi
mov dword [0x101d19d0], eax
call esi
push eax
call fcn.100d59b4
pop ecx
mov dword [0x101d19d8], eax
test eax, eax
je 0x100d9df0
push 0x101b715c
push edi
call esi
push eax
call fcn.100d59b4
pop ecx
mov dword [0x101d19d4], eax
mov eax, dword [0x101d19d4]
cmp eax, ebx
je 0x100d9e48
cmp dword [0x101d19d8], ebx
je 0x100d9e48
push eax
call fcn.100d5a2f
push dword [0x101d19d8]
mov esi, eax
call fcn.100d5a2f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100d9e48
test edi, edi
je 0x100d9e48
call esi
test eax, eax
je 0x100d9e3f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100d9e3f
test byte [ebp - 0xc], 1
jne 0x100d9e48
or dword [ebp + 0x10], 0x200000
jmp 0x100d9e81
mov eax, dword [0x101d19cc]
cmp eax, ebx
je 0x100d9e81
push eax
call fcn.100d5a2f
pop ecx
test eax, eax
je 0x100d9e81
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100d9e81
mov eax, dword [0x101d19d0]
cmp eax, ebx
je 0x100d9e81
push eax
call fcn.100d5a2f
pop ecx
test eax, eax
je 0x100d9e81
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x101d19c8]
call fcn.100d5a2f
pop ecx
test eax, eax
je 0x100d9ea1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100d9ea3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100dacc6
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x101cf4d4]
add eax, 0xfffffdcf
mov dword [0x101cf4d4], eax
call fcn.1000108e
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
je 0x100dad7f
jmp 0x100dae42
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x64], ecx
mov dword [0x101cf4d8], 0x2382
mov edx, dword [esp + 0x1c]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x88], esi
mov dword [0x101cf4d4], 0x17e8
mov esi, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.100db912
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov ecx, dword [0x101cf4d4]
add ecx, 0xfffff71a
mov dword [0x101cf4d4], ecx
mov dword [esp + 0x18], eax
jmp 0x100dae3a
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x1c], ecx
je 0x100dacfd
jmp 0x100dada8
lea eax, [esp + 0x38]
mov dword [0x101cf4d8], 0xcff
mov dword [esp + 0x14], eax
call fcn.100db575
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x18], ecx
je 0x100dadbc
jmp 0x100dae3a
mov eax, dword [esp + 0x20]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x10], eax
jmp 0x100dae22
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.100daa01
lea ecx, [0x100dbf64]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x68], edx
mov dword [esp + 0x3c], 0x10f400
mov edx, dword [0x101cf4c0]
mov dword [esp + 0x44], edx
mov edx, dword [0x101cf4c4]
mov dword [esp + 0x5c], edx
mov edx, dword [0x101cf4c8]
mov dword [esp + 0x7c], edx
mov edx, dword [0x101cf4cc]
mov dword [esp + 0x48], edx
mov edx, dword [0x101cf4d0]
mov dword [esp + 0x78], edx
mov dword [0x101cf4d4], 0xfffff70e
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
cmp word [eax], 0x5a4d
mov dword [esp + 0x20], eax
je 0x100dad69
jmp 0x100dada8
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x100db047
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101cf4e0], 0
mov byte [0x101cf4e4], 0
mov dword [0x101cf4d4], 0x2002
mov dword [0x101cf4d8], 0xf6c
mov dword [0x101cf4dc], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x101cf4d4], 0x142c
mov eax, dword [0x101cf4dc]
add eax, 1
mov dword [0x101cf4dc], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x100db096
jmp 0x100db16e
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x101cf4e8], 0
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov edi, dword [0x101cf4e0]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x101cf4e8], esi
mov dword [0x101cf4d8], 0x232c
mov eax, esi
cdq
idiv ecx
mov dword [0x101cf4e0], edx
mov dword [0x101cf4d4], 0x347
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x101cf4e4], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov cl, byte [0x101cf4e4]
mov esi, dword [0x101cf4e0]
mov byte [ebx + esi], cl
mov esi, dword [0x101cf4dc]
add esi, 1
mov dword [0x101cf4dc], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x100db0cb
jmp 0x100db18c
mov dword [0x101cf4d8], 0x1a2c
xor eax, eax
mov dword [0x101cf4dc], 0
mov dword [ebp - 0x20], eax
jmp 0x100db0cb
mov eax, dword [0x101cf4d8]
add eax, 0xffffeb75
mov dword [0x101cf4d8], eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100db575
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x2c
mov dword [ebp - 0xc], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov esi, dword [0x101cf4d8]
mov edi, esi
add edi, 0xffffde83
mov dword [0x101cf4d4], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ecx
jmp 0x100db648
mov eax, dword [ebp - 0x24]
add esp, 0x2c
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x28]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x2c], eax
jl 0x100db648
jmp 0x100db662
mov eax, dword [ebp - 0x30]
xor ecx, ecx
add eax, 0xfffff184
mov dword [0x101cf4d8], eax
mov dword [ebp - 0x24], ecx
jmp 0x100db5c0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x34]
cmp word [eax + ecx*2 - 0x12], 0x64
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x30], edx
je 0x100db6a7
jmp 0x100db5e3
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x34]
cmp word [eax + ecx*2 - 0x18], 0x6f
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x30], edx
jne 0x100db5e3
mov dword [0x101cf4d8], 0x1815
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x34]
cmp word [eax + ecx*2 - 0x16], 0x61
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x30], edx
je 0x100db689
jmp 0x100db5e3
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], edx
jne 0x100db5ca
mov eax, dword [ebp - 0x2c]
mov dword [0x101cf4d8], 0x9f
mov ecx, dword [ebp - 0x18]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
je 0x100db612
jmp 0x100db5e3
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x34]
cmp word [eax + ecx*2 - 0x14], 0x64
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x30], edx
je 0x100db5f7
jmp 0x100db5e3
mov eax, dword [ebp - 0x1c]
add eax, 0xffffdce0
mov dword [0x101cf4d4], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x34]
cmp word [ecx + edx*2 - 0x10], 0x6c
mov dword [ebp - 0x30], eax
jne 0x100db5e3
mov dword [0x101cf4d4], 0xadf
mov eax, 1
mov ecx, 0xadf
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x34]
cmp word [edx + esi*2 - 0xe], 0x6c
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], ecx
je 0x100db5c0
jmp 0x100db5e3